SMS marketing and the PDPA: a practical checklist for Malaysian businesses

SMS is one of the most direct channels a business has. It is also one of the easiest to get wrong. A message that arrives without permission does not just annoy a customer, it can damage your brand and expose you to complaints under the Personal Data Protection Act 2010 (PDPA).

This checklist is what we go through with every new client before we send anything. It is general guidance, not legal advice, so speak to a lawyer if you are unsure about your situation.

1. Get clear, separate consent

Under the PDPA, you need a lawful basis to use someone’s personal data, and a phone number is personal data. For direct marketing, the safest basis is clear consent that the customer has actively given.

In practice, that means:

• An unticked checkbox on your forms. Pre-ticked boxes do not show that the customer made a choice.
• Separate consent for each channel. Agreeing to receive emails is not the same as agreeing to receive SMS or WhatsApp messages.
• Consent that is not a condition of purchase. A customer should be able to buy from you without signing up for marketing.

2. Tell people what they are signing up for

Your privacy notice should explain, in plain language, what you will send and how often. “Occasional offers and news, no more than four messages a month” sets a clear expectation. The PDPA also requires the notice to be available in both Bahasa Malaysia and English.

3. Identify yourself in every message

Recipients should know who is messaging them without having to guess. Start with your brand name, or use a registered sender ID where your gateway supports it. Most Malaysian SMS gateways also require promotional messages to begin with RM0.00, showing the recipient that the message is free to receive. Check your provider’s rules before you write your template.

4. Make opting out easy

Every promotional message should include a simple way to stop receiving them, such as “Reply STOP to opt out”. The PDPA gives individuals the right to ask you to stop processing their data for direct marketing, so treat opt-outs as a priority:

• Process them automatically where possible.
• Sync opt-outs across every tool you use, so a customer who unsubscribes from SMS does not keep getting messages from another system.
• Never re-add someone who has opted out, even if they appear in a new import.

5. Do not buy or borrow lists

Purchased lists almost never come with valid consent for your business. They also perform badly: high complaint rates, low response and a real risk of your sender ID being blocked. Build your own list from customers who have chosen to hear from you.

6. Keep records

If a customer asks why they received a message, you should be able to answer. For each contact, record:

• When they gave consent and through which form or channel.
• The wording they agreed to.
• Any changes, including opt-outs, with dates.

7. Send at sensible times

This is not a legal requirement, but it matters. We avoid sending promotional messages early in the morning or late at night, and we take extra care around prayer times and public holidays. A good message at a bad time still feels like spam.

8. Protect the data

Limit who in your team can export customer lists, use strong passwords and two-factor authentication on your SMS platform, and delete data you no longer need. The 2024 amendments to the PDPA introduced data breach notification duties, so a leaked spreadsheet is now a reportable incident, not just an embarrassment.

A quick self-check

Before your next campaign, ask yourself:

1. Could I show how each person on this list opted in?
2. Does the message say who it is from?
3. Is there a clear way to opt out?
4. Will opt-outs be removed before the next send?

If the answer to any of these is “no”, fix that first. It is far cheaper than repairing a damaged sender reputation.

If you would like a second pair of eyes on your consent forms or message templates, get in touch. We are happy to take a look.